Privacy Policy

1. Who we are

This website is owned and operated by Bright Flower Retreats Ltd ("we", "us", "our"), a private limited company registered in England and Wales under company number 15839894. Our registered office is 16 St. Michaels Road, Worthing, BN11 4SD, United Kingdom.

We are the data controller for the personal data described in this policy. You can reach us by email at info@brightflw.online or in writing at the address above.

2. What personal data we collect

We collect only the information needed to answer your enquiry, to arrange a retreat if you book one, and to meet our legal obligations.

• Information you give us — your name, email address, telephone number (if you choose to give it), and the content of any message or enquiry you send us.
• Booking information — where relevant, dietary requirements, accessibility needs, and emergency contact details you provide when booking a retreat.
• Technical information — limited server-log data such as IP address, browser type, and pages visited. This is used to keep the site working and secure.

We do not knowingly collect special-category data (for example health information) unless you give it to us voluntarily in connection with a booking.

3. How we use your data

We use your personal data for the following purposes:

• To reply to enquiries you send us through the contact form, email, or telephone.
• To arrange, confirm, and deliver retreats you book with us.
• To issue invoices and keep accounting records required by UK law.
• To keep this website secure and functioning.

We do not use your personal data for profiling or automated decision-making, and we do not sell your data to third parties.

4. Lawful bases

Under UK GDPR we rely on the following lawful bases:

• Consent — when you submit an enquiry form or subscribe to a list.
• Contract — when we need your data to prepare for or deliver a booking you've made.
• Legal obligation — to meet accounting, tax, and other legal requirements.
• Legitimate interests — to run and secure our website and to respond to general correspondence.

5. How long we keep it

Enquiry correspondence is kept for up to two years from the last exchange, after which it is deleted unless you've become a customer. Booking and accounting records are kept for six years after the end of the financial year to which they relate, as required by HMRC.

6. Who we share it with

We share your data only where strictly necessary, and only with:

• Our email hosting provider, so that we can receive and reply to your messages.
• Our website hosting provider, which stores log data on our behalf.
• Partner venues and caterers where this is needed to deliver a retreat you've booked (for example to pass on dietary requirements). We share only what is necessary for the booking.
• Our accountants, where required for tax and company filings.
• Public authorities, where we are legally required to do so.

7. International transfers

Our processors are based in the United Kingdom and the European Economic Area wherever possible. Where any transfer outside the UK/EEA is unavoidable, we rely on safeguards recognised by UK GDPR (such as the UK International Data Transfer Addendum).

8. Your rights

Under UK data-protection law you have the right to:

• Access the personal data we hold about you.
• Ask us to correct data that is inaccurate.
• Ask us to delete data we no longer need.
• Object to or restrict certain processing.
• Receive a portable copy of data you've provided to us.
• Withdraw consent at any time, where consent was the lawful basis.

To exercise any of these rights, write to us at info@brightflw.online. We'll respond within one month.

9. Complaints

If you believe we've handled your data poorly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator — ico.org.uk.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll change the "Last updated" date at the top. Material changes will be flagged on the home page for a reasonable period.